Placement of VPN Router

[King_1988]

Hi,

We have spare router, as per management decision we have to use it as VPN router. Can you please help me where we can fit this in our topology. We want to place it between Core router (ISR-4331) and Core Firewall (FTD-2130) and Core router is currently connected to ISP. How we can make it work (Routing) or any other suggestion?

[MHM Cisco World]

VPN meaning 
Site to Site 
or 
Remote Access
MHM

[King_1988]

Only For Remote-Access

[balaji.bandi]

What Core Router is this ? do you have any Additional Interface on that Router - so i suggest to connect as below :

On the Core Router you can do NAT ( or if you have more Public IP address you can use).

[King_1988]

Thanks. In this case, for VPN router one-leg should be connected to Core Router and other to Core Firewall right?

[balaji.bandi]

Personally you do not required to have dual legs, you can use single leg connection to achieve that for RA VPN.

but if you have more ports available you can also achieve both models

Router required throughput license - base is only limited to certain check the documents.

[King_1988]

Yes NAT is happening on Core Router. Should we place like below?

[MHM Cisco World]

[King_1988]

Thanks. Can you please guide us how we can ensure routing part and VPN part to make this thing working?

[MHM Cisco World]

for VPN part I dont know what you meaning. 
you use router as VPN RA so what is RA you meaning ?
for routing 
the VPN Pool subnet config in VPN router 
in FTD config route to VPN subnet toward the VPN router 
in VPN router config default toward the Edge route 
in VPN router config route for internal subnet toward FTD 

MHM

[Karsten Iwen]

The proposed solution is my personal favorite if there is already a redundant setup. But if not, you need two ports on the Core router, which is often unavailable. Adding a switch just for this purpose adds another single point of failure. In this case, I would place the router one-armed or two-armed directly on the firewall.

But as you mention remote-assess VPN, I would rethinking this approach as the the FTD is much more powerful than the ISR when it comes to RA-VPN.

[King_1988]

But for this FTD,  it does not have VPN license

[Karsten Iwen]

Then it is more than likely that you don't have a valid Cisco Secure Client License at all. You need this regardless of the VPN platform.